Log in Start free

Vulnerability · Published Jan 11, 2022 · Assigned by siemens

CVE-2021-45034

High 7.5

In plain English

A high-severity improper access control in CP-8000 MASTER MODULE WITH I/O -25/+70°C from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.4%top 16.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.

Affected products (as reported)

VendorProductVersions
Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions < V16.20
Siemens CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions < V16.20
Siemens CP-8021 MASTER MODULE All versions < V16.20
Siemens CP-8022 MASTER MODULE WITH GPRS All versions < V16.20

Weakness: CWE-284

References